9a8fafe
@@ -58,6 +58,12 @@
curl -sX POST localhost:3000/api/v1/repos -H "authorization: Bearer $TOKEN" \
git clone "http://you:$TOKEN@localhost:3000/you/hello.git"
```
The commits the forge writes for you — merges, squashes, reverts, web edits —
carry `[email protected].<forge host>`, never your account email. Choosing your
real address is an opt-in under **Commit email** in `/settings` (or
`PATCH /api/v1/user` with `{"commitEmail":"account"}`); commits you push
yourself carry whatever your own git says.
## Live in the terminal
`ssh` into the forge and you get the whole thing — repositories, code, issues,
@@ -23,6 +23,7 @@
export type Exclusion = {
export const GATE: readonly string[] = [
  "test/crew.test.ts",
  "test/commit-identity.test.ts",
  "test/review-route.test.ts",
  "test/review-lines.test.ts",
  "test/review-gate.test.ts",
@@ -16,6 +16,7 @@
import type { App } from "../app.ts";
import { canAdmin, type Repo } from "../core/repos.ts";
import { trackPullHead, type Pull } from "../core/pulls.ts";
import { commitIdentity } from "../core/commit_identity.ts";
import type { User } from "../core/users.ts";
import { isSafeTreePath } from "../git/guard.ts";
import { repoDir } from "../git/repos.ts";
@@ -187,10 +188,7 @@
export async function editFiles(
      ...(branch !== base ? { startPoint: base } : {}),
      message: input.message?.trim() || "Update files",
      files: input.files,
      author: {
        name: writer.value.displayName || writer.value.username,
        email: writer.value.email,
      },
      author: commitIdentity(app.config, writer.value),
      ...(send === undefined
        ? {}
        : {
@@ -16,6 +16,7 @@
import {
  type TakeError,
} from "../core/following.ts";
import { canRead, getRepoById, type Repo } from "../core/repos.ts";
import { commitIdentity } from "../core/commit_identity.ts";
import type { User } from "../core/users.ts";
import { divergence } from "../git/branches.ts";
import { resolveOid } from "../git/merge.ts";
@@ -81,8 +82,7 @@
export async function takeUpdates(
  const who = writer.value;
  return take(app, fork, parent, {
    id: who.id,
    name: who.displayName || who.username,
    email: who.email,
    ...commitIdentity(app.config, who),
  });
}
@@ -51,6 +51,7 @@
import {
  type Side,
  type ThreadState,
} from "../core/reviews.ts";
import { commitIdentity } from "../core/commit_identity.ts";
import { getUserById, getUserByName, type User } from "../core/users.ts";
import type { MergeStrategy } from "../git/merge.ts";
import { fetchInto, resolveOid, writeRef } from "../git/merge.ts";
@@ -339,31 +340,20 @@
export async function mergePull(
  // A fork may have pushed since the pull opened; merge what is being
  // proposed now, not the snapshot taken when it was.
  await refreshPullHead(app, repo, pull);
  const lander = {
    name: writer.value.displayName || writer.value.username,
    email: writer.value.email,
  };
  const lander = commitIdentity(app.config, writer.value);
  // The agent that wrote the change is the commit's author; the person who
  // asked is named in `Requested-by`, the person who landed it in
  // `Co-authored-by`.
  const writtenBy = getUserById(app.db, pull.authorId);
  const agentAuthor =
    writtenBy?.kind === "agent"
      ? {
          name: writtenBy.displayName || writtenBy.username,
          email: writtenBy.email,
        }
      ? commitIdentity(app.config, writtenBy)
      : undefined;
  const asked = toldBy(app.db, pull);
  const requester =
    asked === null ? undefined : getUserByName(app.db, asked);
  const trailers = landingTrailers(
    requester
      ? {
          name: requester.displayName || requester.username,
          email: requester.email,
        }
      : null,
    requester ? commitIdentity(app.config, requester) : null,
    lander,
  );
  const merged = await landPull(
@@ -22,6 +22,7 @@
import {
  type Repo,
  type RepoSettings,
} from "../core/repos.ts";
import { commitIdentity } from "../core/commit_identity.ts";
import type { User } from "../core/users.ts";
import {
  createWebhook as insertWebhook,
@@ -334,10 +335,7 @@
export async function commitToBranch(
      ...(branch !== startPoint ? { startPoint } : {}),
      message: input.message || "Update files",
      files: input.files,
      author: {
        name: writer.value.displayName || writer.value.username,
        email: writer.value.email,
      },
      author: commitIdentity(app.config, writer.value),
    },
  );
  if (!committed.ok) return committed;
@@ -10,6 +10,7 @@
import type { App } from "../app.ts";
import { revertOf, type Pull } from "../core/pulls.ts";
import type { Repo } from "../core/repos.ts";
import { commitIdentity } from "../core/commit_identity.ts";
import type { User } from "../core/users.ts";
import { resolveOid } from "../git/merge.ts";
import { repoDir } from "../git/repos.ts";
@@ -58,10 +59,7 @@
export async function revertPull(
    commitOid: pull.mergedOid,
    ontoOid: onto,
    message: `Revert "${pull.title}" (#${pull.number})`,
    author: {
      name: writer.value.displayName || writer.value.username,
      email: writer.value.email,
    },
    author: commitIdentity(app.config, writer.value),
  });
  if (!built.ok) return built;
@@ -94,7 +94,7 @@
export function updateProfile(
  if (!user.ok) return user;
  const updated = writeProfile(app.db, user.value.id, patch);
  if (!updated.ok) return updated;
  const fields = (["displayName", "email"] as const).filter(
  const fields = (["displayName", "email", "commitEmail"] as const).filter(
    (k) => patch[k] !== undefined,
  );
  app.bus.append({
@@ -0,0 +1,44 @@
/**
 * The name and address a commit the forge writes for a person carries.
 *
 * A commit is published in every clone of a public repository, forever, and
 * an address in it cannot be taken back without rewriting history. So the
 * address is one the person chose to publish: a no-reply address on this
 * forge's own host unless they opted in to their account email on the
 * settings page (#623). The account email itself is never the default.
 */
import type { ForgeConfig } from "../app.ts";
import type { User } from "./users.ts";
export interface CommitIdentity {
  readonly name: string;
  readonly email: string;
}
/** The host this forge is reached at: its public URL's, else its own name. */
export function forgeHost(config: Pick<ForgeConfig, "url" | "host">): string {
  return config.url !== undefined
    ? new URL(config.url).hostname
    : (config.host ?? "localhost");
}
/** `<username>@users.noreply.<host>` — an address that reaches nobody. */
export function noreplyAddress(username: string, host: string): string {
  return `${username}@users.noreply.${host}`;
}
/**
 * Who a commit says wrote it. An agent's address is the forge's own
 * invention (`…@agents.invalid`) and names nobody's mailbox, so it is used
 * as it is; a person's is their no-reply address unless they opted in.
 */
export function commitIdentity(
  config: Pick<ForgeConfig, "url" | "host">,
  user: Pick<User, "username" | "displayName" | "email" | "kind" | "commitEmail">,
): CommitIdentity {
  const name = user.displayName || user.username;
  if (user.kind === "agent" || user.commitEmail === "account")
    return { name, email: user.email };
  return { name, email: noreplyAddress(user.username, forgeHost(config)) };
}
@@ -1189,4 +1189,10 @@
export const migrations: readonly string[] = [
    created_at    TEXT NOT NULL
  );
  `,
  // 46 — which address the forge's commits for a person carry (#623). The
  // default is the no-reply one; the account email is an explicit opt-in.
  `
  ALTER TABLE user ADD COLUMN commit_email TEXT NOT NULL DEFAULT 'noreply'
    CHECK (commit_email IN ('noreply','account'));
  `,
];
@@ -5,6 +5,7 @@
import type { Database } from "bun:sqlite";
import { isSafeName } from "../git/guard.ts";
import { noreplyAddress } from "./commit_identity.ts";
import { id } from "../kernel/id.ts";
import { err, ok, type Result } from "../kernel/result.ts";
@@ -20,9 +21,17 @@
export interface User {
   * tokens the forge mints for a run (docs/APPS.md).
   */
  readonly kind: "user" | "org" | "agent";
  /**
   * Which address the commits the forge writes for this person carry: the
   * no-reply one on the forge's host, or — by explicit opt-in — `email`
   * (`core/commit_identity.ts`).
   */
  readonly commitEmail: CommitEmail;
  readonly createdAt: string;
}
export type CommitEmail = "noreply" | "account";
interface UserRow {
  id: string;
  username: string;
@@ -32,6 +41,7 @@
interface UserRow {
  password_hash: string;
  kind: "user" | "org";
  is_agent: number;
  commit_email: CommitEmail;
  created_at: string;
}
@@ -45,6 +55,7 @@
function toUser(row: UserRow): User {
    // The flag, not the column, decides: see migration 14 for why an agent
    // is stored as kind 'user' with is_agent set.
    kind: row.is_agent === 1 ? "agent" : row.kind,
    commitEmail: row.commit_email === "account" ? "account" : "noreply",
    createdAt: row.created_at,
  };
}
@@ -159,11 +170,13 @@
function isUniqueViolation(error: unknown): boolean {
export interface ProfilePatch {
  displayName?: string;
  email?: string;
  commitEmail?: CommitEmail;
}
export type UpdateProfileError =
  | "email_taken"
  | "invalid_email"
  | "invalid_commit_email"
  | "no_such_user";
/** Change the mutable profile fields. Absent keys are left untouched. */
@@ -186,11 +199,12 @@
export function updateProfile(
  const displayName = (patch.displayName ?? current.displayName)
    .trim()
    .slice(0, MAX_DISPLAY_NAME);
  db.query("UPDATE user SET email = ?1, display_name = ?2 WHERE id = ?3").run(
    email,
    displayName,
    userId,
  );
  const commitEmail = patch.commitEmail ?? current.commitEmail;
  if (commitEmail !== "noreply" && commitEmail !== "account")
    return err("invalid_commit_email");
  db.query(
    "UPDATE user SET email = ?1, display_name = ?2, commit_email = ?3 WHERE id = ?4",
  ).run(email, displayName, commitEmail, userId);
  return ok(getUserById(db, userId)!);
}
@@ -244,7 +258,7 @@
export async function ensureEdgeUser(
  if (existing) return existing.kind === "user" ? existing : undefined;
  const made = await createUser(db, {
    username: login,
    email: `${login}@users.noreply.${host}`,
    email: noreplyAddress(login, host),
    adminIfFirst: true,
  });
  return made.ok ? made.value : undefined;
@@ -27,6 +27,7 @@
import { listIssues, setAssignee, type Issue } from "../core/issues.ts";
import { closesFromBody, listPulls, type Pull } from "../core/pulls.ts";
import { getRepoById, type Repo } from "../core/repos.ts";
import { activeRunFor, listRuns } from "../core/runs.ts";
import { commitIdentity } from "../core/commit_identity.ts";
import { getUserById, type User } from "../core/users.ts";
import { createLog } from "../kernel/log.ts";
import { parkedCount } from "./autonomy.ts";
@@ -221,8 +222,7 @@
async function diverged(app: App, fork: Repo, parent: Repo): Promise<void> {
    if (by === undefined) return;
    const took = await takeUpdates(app, fork, parent, {
      id: by.id,
      name: by.displayName || by.username,
      email: by.email,
      ...commitIdentity(app.config, by),
    });
    log.info(took.ok ? "took the parent's updates" : "could not take updates", {
      fork: `${fork.ownerName}/${fork.name}`,
@@ -924,11 +924,20 @@
export function apiRoutes(router: Router<Handler>): void {
    const denied = requireAccount(ctx, { adminToken: true });
    if (denied) return denied;
    const input = await body(ctx.request);
    if (
      input.commitEmail !== undefined &&
      input.commitEmail !== "noreply" &&
      input.commitEmail !== "account"
    )
      return json({ error: "invalid_commit_email" }, 422);
    const updated = updateProfile(ctx.app, ctx.auth.user, {
      ...(typeof input.displayName === "string"
        ? { displayName: input.displayName }
        : {}),
      ...(typeof input.email === "string" ? { email: input.email } : {}),
      ...(input.commitEmail === "noreply" || input.commitEmail === "account"
        ? { commitEmail: input.commitEmail }
        : {}),
    });
    if (!updated.ok) return respondAccess(updated.error, 422);
    return json(publicUser(updated.value));
@@ -211,6 +211,8 @@
export function publicUser(user: User) {
    username: user.username,
    displayName: user.displayName,
    isAdmin: user.isAdmin,
    // Which address commits carry — the choice, never the address itself.
    commitEmail: user.commitEmail,
  };
}
@@ -10,6 +10,7 @@
import { trackPullHead } from "../core/pulls.ts";
import { createRepo } from "../actions/repos.ts";
import { sessionUser } from "../core/sessions.ts";
import { scopeAllows, verifyToken } from "../core/tokens.ts";
import { forgeHost } from "../core/commit_identity.ts";
import { ensureEdgeUser, verifyPassword } from "../core/users.ts";
import { edgeIdentity } from "./edge.ts";
import { healthResponse } from "./health.ts";
@@ -324,11 +325,7 @@
async function resolveAuth(app: App, request: Request): Promise<Auth> {
  // in; its word outranks a cookie of ours.
  const login = edgeIdentity(request, app.config.edgeToken);
  if (login !== undefined) {
    const host =
      app.config.url !== undefined
        ? new URL(app.config.url).hostname
        : (app.config.host ?? "localhost");
    const user = await ensureEdgeUser(app.db, login, host);
    const user = await ensureEdgeUser(app.db, login, forgeHost(app.config));
    if (user) return { user, scope: "admin", via: "edge" };
  }
@@ -23,8 +23,10 @@
import {
  notifyUrlOf,
  setNotifyUrl,
} from "../../crew/notify.ts";
import { forgeHost, noreplyAddress } from "../../core/commit_identity.ts";
import { listKeys } from "../../core/keys.ts";
import { listTokens, type TokenScope } from "../../core/tokens.ts";
import type { CommitEmail, User } from "../../core/users.ts";
import type { Ctx } from "../../http/context.ts";
import { sshCommand } from "../../ssh/command.ts";
import {
@@ -78,9 +80,17 @@
export function accountShell(
interface ProfileForm {
  displayName: string;
  email: string;
  commitEmail: CommitEmail;
  errors?: { displayName?: string; email?: string };
}
/** The profile form as the account stands now. */
const currentProfile = (user: User): ProfileForm => ({
  displayName: user.displayName,
  email: user.email,
  commitEmail: user.commitEmail,
});
function notifyView(ctx: Ctx, error?: string): Html {
  const host = notifyHost(notifyUrlOf(ctx.app.db, ctx.auth.user!.id));
  return card(
@@ -138,9 +148,26 @@
function profileView(ctx: Ctx, values: ProfileForm): Html {
        type: "email",
        value: values.email,
        autocomplete: "email",
        hint: "Used to attribute commits. Never shown to other people.",
        hint: "Where the forge reaches you. Never shown to other people, and never in a commit unless you choose it below.",
        ...(values.errors?.email ? { error: values.errors.email } : {}),
      })}
      ${selectField({
        label: "Commit email",
        name: "commitEmail",
        options: [
          {
            value: "noreply",
            label: noreplyAddress(user.username, forgeHost(ctx.app.config)),
            selected: values.commitEmail === "noreply",
          },
          {
            value: "account",
            label: "My email above — published in every clone",
            selected: values.commitEmail === "account",
          },
        ],
        hint: "The address on commits the forge makes for you: merges, reverts, web edits. A commit in a public repository cannot be taken back, so the default reaches nobody.",
      })}
      <div class="form-actions">
        ${btn("Save profile", { variant: "primary" })}
      </div>
@@ -156,10 +183,7 @@
export function accountPage(ctx: Ctx): Response {
    ctx,
    "profile",
    "Settings",
    html`${profileView(ctx, {
      displayName: ctx.auth.user.displayName,
      email: ctx.auth.user.email,
    })}${notifyView(ctx)}`,
    html`${profileView(ctx, currentProfile(ctx.auth.user))}${notifyView(ctx)}`,
  );
}
@@ -174,10 +198,10 @@
export async function notifyUpdate(ctx: Ctx): Promise<Response> {
      ctx,
      "profile",
      "Settings",
      html`${profileView(ctx, {
        displayName: ctx.auth.user.displayName,
        email: ctx.auth.user.email,
      })}${notifyView(ctx, NOTIFY_ERRORS[saved.error])}`,
      html`${profileView(ctx, currentProfile(ctx.auth.user))}${notifyView(
        ctx,
        NOTIFY_ERRORS[saved.error],
      )}`,
      422,
    );
  // The notifier starts from what asks now, so only what comes after is new.
@@ -195,8 +219,16 @@
export async function accountUpdate(ctx: Ctx): Promise<Response> {
  if (form instanceof Response) return form;
  const displayName = field(form, "displayName").trim();
  const email = field(form, "email").trim();
  // Absent (an older form) leaves the choice as it stands; anything but the
  // two offered values is refused by the profile write.
  const chosen = field(form, "commitEmail");
  const commitEmail = (chosen || ctx.auth.user.commitEmail) as CommitEmail;
  const updated = updateProfile(ctx.app, ctx.auth.user, { displayName, email });
  const updated = updateProfile(ctx.app, ctx.auth.user, {
    displayName,
    email,
    commitEmail,
  });
  if (!updated.ok) {
    const errors: ProfileForm["errors"] =
      updated.error === "email_taken"
@@ -208,7 +240,15 @@
export async function accountUpdate(ctx: Ctx): Promise<Response> {
      ctx,
      "profile",
      "Settings",
      profileView(ctx, { displayName, email, errors }),
      profileView(ctx, {
        displayName,
        email,
        commitEmail:
          commitEmail === "noreply" || commitEmail === "account"
            ? commitEmail
            : ctx.auth.user.commitEmail,
        errors,
      }),
      422,
    );
  }
@@ -0,0 +1,353 @@
/**
 * The address on commits the forge writes for a person (#623). A commit in a
 * public repository is published in every clone forever, so it carries a
 * no-reply address on the forge's host unless the person opted in to their
 * account email — through the settings page or the API, never by default.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { editFiles } from "../src/actions/contents.ts";
import { mergePull, openPull } from "../src/actions/pulls.ts";
import { commitToBranch, createRepo } from "../src/actions/repos.ts";
import { revertPull } from "../src/actions/revert.ts";
import { updateProfile } from "../src/actions/users.ts";
import {
  commitIdentity,
  forgeHost,
  noreplyAddress,
} from "../src/core/commit_identity.ts";
import type { Repo } from "../src/core/repos.ts";
import {
  createUser,
  getUserByName,
  updateProfile as writeProfile,
  type User,
} from "../src/core/users.ts";
import { repoDir } from "../src/git/repos.ts";
import { serve, type Servers } from "../src/http/server.ts";
describe("commitIdentity", () => {
  const person = {
    username: "alice",
    displayName: "Alice",
    email: "[email protected]",
    kind: "user" as const,
  };
  test("a person's default is the no-reply address on the forge's host", () => {
    expect(
      commitIdentity(
        { host: "forge.example" },
        { ...person, commitEmail: "noreply" },
      ),
    ).toEqual({ name: "Alice", email: "[email protected]" });
  });
  test("the account email only when the person opted in", () => {
    expect(
      commitIdentity({}, { ...person, commitEmail: "account" }).email,
    ).toBe("[email protected]");
  });
  test("the public URL's host outranks the bind host, and has no port", () => {
    expect(
      forgeHost({ url: "https://forge.open-platform.sh:8443", host: "0.0.0.0" }),
    ).toBe("forge.open-platform.sh");
    expect(forgeHost({})).toBe("localhost");
    expect(noreplyAddress("bob", "f.dev")).toBe("[email protected]");
  });
  test("an agent keeps the address the forge invented for it", () => {
    expect(
      commitIdentity(
        {},
        {
          username: "scout",
          displayName: "",
          email: "[email protected]",
          kind: "agent",
          commitEmail: "noreply",
        },
      ),
    ).toEqual({ name: "scout", email: "[email protected]" });
  });
});
describe("commits the forge makes for a person", () => {
  let dataDir: string;
  let app: App;
  let alice: User;
  let carol: User;
  let repo: Repo;
  let carols: Repo;
  let dir: string;
  const dirOf = (r: Repo) => repoDir(app.reposRoot, r.ownerName, r.name);
  const whoMade = (rev: string, r: Repo = repo): string =>
    Bun.spawnSync(["git", "log", "-1", "--format=%ae|%ce", rev], {
      cwd: dirOf(r),
    })
      .stdout.toString()
      .trim();
  const madeRepo = async (owner: User, name: string): Promise<Repo> => {
    const made = await createRepo(app, owner, { name, visibility: "public" });
    if (!made.ok) throw new Error(String(made.error));
    await commitToBranch(app, owner, made.value, {
      branch: "main",
      message: "base",
      files: [{ path: "README.md", content: "hi\n" }],
    });
    return made.value;
  };
  const shipped = async (
    by: User,
    branch: string,
    strategy: "merge" | "squash",
    repo: Repo,
  ) => {
    const wrote = await commitToBranch(app, by, repo, {
      branch,
      base: "main",
      message: `work on ${branch}`,
      files: [{ path: `${branch}.txt`, content: branch }],
    });
    if (!wrote.ok) throw new Error(JSON.stringify(wrote.error));
    const opened = await openPull(app, by, repo, {
      title: branch,
      baseBranch: "main",
      headBranch: branch,
    });
    if (!opened.ok) throw new Error(JSON.stringify(opened.error));
    const merged = await mergePull(app, by, repo, opened.value, strategy);
    if (!merged.ok) throw new Error(JSON.stringify(merged.error));
    return { pull: opened.value, oid: merged.value.mergeOid };
  };
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-commit-identity-"));
    app = createApp({ dataDir, port: 0, host: "forge.example" });
    const a = await createUser(app.db, {
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    const c = await createUser(app.db, {
      username: "carol",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!a.ok || !c.ok) throw new Error("users");
    alice = a.value;
    const opted = updateProfile(app, c.value, { commitEmail: "account" });
    if (!opted.ok) throw new Error(opted.error);
    carol = opted.value;
    repo = await madeRepo(alice, "app");
    carols = await madeRepo(carol, "notes");
    dir = dirOf(repo);
  });
  afterAll(async () => {
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("a new account defaults to the no-reply address", () => {
    expect(alice.commitEmail).toBe("noreply");
    expect(getUserByName(app.db, "alice")?.commitEmail).toBe("noreply");
  });
  test("a merge by the default setting is authored and committed at the no-reply address", async () => {
    const { oid } = await shipped(alice, "feature", "merge", repo);
    expect(whoMade(oid)).toBe(
      "[email protected]|[email protected]",
    );
  });
  test("a squash and a revert carry it too", async () => {
    const { pull, oid } = await shipped(alice, "squashed", "squash", repo);
    expect(whoMade(oid)).toBe(
      "[email protected]|[email protected]",
    );
    const { getPull } = await import("../src/core/pulls.ts");
    const landed = getPull(app.db, repo.id, pull.number)!;
    const reverted = await revertPull(app, alice, repo, landed);
    if (!reverted.ok) throw new Error(JSON.stringify(reverted.error));
    expect(whoMade(`refs/heads/revert-${pull.number}`)).toBe(
      "[email protected]|[email protected]",
    );
  });
  test("a web edit, a new file and a delete by the default setting carry it", async () => {
    for (const files of [
      [{ path: "README.md", content: "edited\n" }],
      [{ path: "new.txt", content: "new\n" }],
      [{ path: "new.txt", content: null }],
    ]) {
      const edited = await editFiles(app, alice, repo, {
        branch: "main",
        message: "web edit",
        files,
      });
      if (!edited.ok) throw new Error(JSON.stringify(edited.error));
      expect(whoMade(edited.value.commit.commitOid)).toBe(
        "[email protected]|[email protected]",
      );
    }
  });
  test("a person who opted in gets their account email, on a merge and a web edit", async () => {
    const { oid } = await shipped(carol, "carols", "merge", carols);
    expect(whoMade(oid, carols)).toBe("[email protected]|[email protected]");
    const edited = await editFiles(app, carol, carols, {
      branch: "main",
      files: [{ path: "carol.txt", content: "c" }],
    });
    if (!edited.ok) throw new Error(JSON.stringify(edited.error));
    expect(whoMade(edited.value.commit.commitOid, carols)).toBe(
      "[email protected]|[email protected]",
    );
  });
  test("the private account email is in no git object at all", () => {
    const everything = Bun.spawnSync(
      ["git", "cat-file", "--batch-all-objects", "--batch"],
      { cwd: dir },
    ).stdout.toString();
    expect(everything).toContain("[email protected]");
    expect(everything).not.toContain("[email protected]");
  });
  test("the setting refuses anything but its two values", () => {
    const bad = writeProfile(app.db, alice.id, {
      commitEmail: "everyone" as never,
    });
    expect(bad.ok).toBe(false);
    if (!bad.ok) expect(bad.error).toBe("invalid_commit_email");
    expect(getUserByName(app.db, "alice")?.commitEmail).toBe("noreply");
  });
});
describe("choosing the commit address", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let cookie = "";
  const form = (fields: Record<string, string>) => new URLSearchParams(fields);
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-commit-email-page-"));
    app = createApp({ dataDir, port: 0, host: "forge.example" });
    servers = await serve(app);
    base = servers.url;
    const res = await fetch(`${base}/signup`, {
      method: "POST",
      body: form({
        username: "dana",
        email: "[email protected]",
        password: "a-good-passphrase",
      }),
      redirect: "manual",
    });
    cookie = (res.headers.get("set-cookie") ?? "").split(";")[0]!;
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("the settings page offers the no-reply address, selected", async () => {
    const page = await (
      await fetch(`${base}/settings`, { headers: { cookie } })
    ).text();
    expect(page).toContain('name="commitEmail"');
    expect(page).toMatch(
      /value="noreply"\s+selected\s*>\s*dana@users\.noreply\.forge\.example/,
    );
  });
  test("opting in is an explicit choice on the page, and opting out undoes it", async () => {
    const post = (commitEmail: string) =>
      fetch(`${base}/settings`, {
        method: "POST",
        headers: { cookie },
        body: form({
          displayName: "",
          email: "[email protected]",
          commitEmail,
        }),
        redirect: "manual",
      });
    expect((await post("account")).status).toBe(303);
    expect(getUserByName(app.db, "dana")?.commitEmail).toBe("account");
    expect((await post("noreply")).status).toBe(303);
    expect(getUserByName(app.db, "dana")?.commitEmail).toBe("noreply");
    expect((await post("<script>")).status).toBe(422);
    expect(getUserByName(app.db, "dana")?.commitEmail).toBe("noreply");
  });
  test("a profile save without the field leaves the choice alone", async () => {
    writeProfile(app.db, getUserByName(app.db, "dana")!.id, {
      commitEmail: "account",
    });
    const res = await fetch(`${base}/settings`, {
      method: "POST",
      headers: { cookie },
      body: form({ displayName: "Dana", email: "[email protected]" }),
      redirect: "manual",
    });
    expect(res.status).toBe(303);
    expect(getUserByName(app.db, "dana")?.commitEmail).toBe("account");
    writeProfile(app.db, getUserByName(app.db, "dana")!.id, {
      commitEmail: "noreply",
    });
  });
  test("a cross-site form cannot flip it", async () => {
    const res = await fetch(`${base}/settings`, {
      method: "POST",
      headers: { cookie, origin: "https://evil.test" },
      body: form({ email: "[email protected]", commitEmail: "account" }),
      redirect: "manual",
    });
    expect(res.status).toBe(403);
    expect(getUserByName(app.db, "dana")?.commitEmail).toBe("noreply");
  });
  test("the API names the choice, never the address, and validates it", async () => {
    const res = await fetch(`${base}/api/v1/user`, { headers: { cookie } });
    const me = (await res.json()) as { commitEmail?: string };
    expect(me.commitEmail).toBe("noreply");
    expect(JSON.stringify(me)).not.toContain("[email protected]");
    const bad = await fetch(`${base}/api/v1/user`, {
      method: "PATCH",
      headers: { cookie, "content-type": "application/json", origin: base },
      body: JSON.stringify({ commitEmail: "everyone" }),
    });
    expect(bad.status).toBe(422);
    const good = await fetch(`${base}/api/v1/user`, {
      method: "PATCH",
      headers: { cookie, "content-type": "application/json", origin: base },
      body: JSON.stringify({ commitEmail: "account" }),
    });
    expect(good.status).toBe(200);
    expect(((await good.json()) as { commitEmail?: string }).commitEmail).toBe("account");
  });
  test("the public profile and the feed never carry the account email", async () => {
    for (const path of ["/dana", "/api/v1/users/dana"]) {
      const res = await fetch(`${base}${path}`);
      expect(await res.text()).not.toContain("[email protected]");
    }
  });
});
@@ -253,6 +253,7 @@
describe("edits: refusals that must leave nothing behind", () => {
    expect(await refs()).toEqual([...before, "refs/heads/proposal"].sort());
  });
  // The actor's, at the address they publish — the no-reply one by default.
  test("commit identity is the actor's, whatever the body claims", async () => {
    const r = await edit({
      author: { name: "Mallory", email: "[email protected]" },
@@ -263,7 +264,9 @@
describe("edits: refusals that must leave nothing behind", () => {
    const who = (
      await git(["log", "-1", "--format=%an <%ae>|%cn <%ce>", "main"])
    ).stdout.trim();
    expect(who).toBe("alice <[email protected]>|alice <[email protected]>");
    expect(who).toBe(
      "alice <[email protected]>|alice <[email protected]>",
    );
  });
  test("racing edits to one branch: exactly one lands, the rest hear branch_moved", async () => {
@@ -127,7 +127,8 @@
describe("oauth discovery and registration", () => {
  });
  test("the migration is idempotent", () => {
    const ddl = migrations[migrations.length - 1]!;
    // Found by what it says, not where it sits: a later migration moves it.
    const ddl = migrations.find((m) => m.includes("TABLE IF NOT EXISTS oauth_client"))!;
    expect(ddl).toContain("oauth_client");
    expect(() => app.db.exec(ddl)).not.toThrow();
    expect(() => app.db.exec(ddl)).not.toThrow();
@@ -146,8 +146,8 @@
describe("who told and who shipped", () => {
      { cwd: repoDir(app.reposRoot, "alice", "notes") },
    ).stdout.toString();
    expect(log).toContain("scout|alice");
    expect(log).toContain("Requested-by: bob <bob@forge.local>");
    expect(log).toContain("Co-authored-by: alice <alice@forge.local>");
    expect(log).toContain("Requested-by: bob <bob@users.noreply.localhost>");
    expect(log).toContain("Co-authored-by: alice <alice@users.noreply.localhost>");
    const board = await (await get("/board")).text();
    expect(board).toContain("told by bob");
		@@ -58,6 +58,12 @@ curl -sX POST localhost:3000/api/v1/repos -H "authorization: Bearer $TOKEN" \
58	58	git clone "http://you:$TOKEN@localhost:3000/you/hello.git"
59	59	```
60	60
	61	The commits the forge writes for you — merges, squashes, reverts, web edits —
	62	carry `[email protected].<forge host>`, never your account email. Choosing your
	63	real address is an opt-in under Commit email in `/settings` (or
	64	`PATCH /api/v1/user` with `{"commitEmail":"account"}`); commits you push
	65	yourself carry whatever your own git says.
	66
61	67	## Live in the terminal
62	68
63	69	`ssh` into the forge and you get the whole thing — repositories, code, issues,
		@@ -23,6 +23,7 @@ export type Exclusion = {
23	23
24	24	export const GATE: readonly string[] = [
25	25	"test/crew.test.ts",
	26	"test/commit-identity.test.ts",
26	27	"test/review-route.test.ts",
27	28	"test/review-lines.test.ts",
28	29	"test/review-gate.test.ts",
		@@ -16,6 +16,7 @@
16	16	import type { App } from "../app.ts";
17	17	import { canAdmin, type Repo } from "../core/repos.ts";
18	18	import { trackPullHead, type Pull } from "../core/pulls.ts";
	19	import { commitIdentity } from "../core/commit_identity.ts";
19	20	import type { User } from "../core/users.ts";
20	21	import { isSafeTreePath } from "../git/guard.ts";
21	22	import { repoDir } from "../git/repos.ts";
		@@ -187,10 +188,7 @@ export async function editFiles(
187	188	...(branch !== base ? { startPoint: base } : {}),
188	189	message: input.message?.trim() \|\| "Update files",
189	190	files: input.files,
190		author: {
191		name: writer.value.displayName \|\| writer.value.username,
192		email: writer.value.email,
193		},
	191	author: commitIdentity(app.config, writer.value),
194	192	...(send === undefined
195	193	? {}
196	194	: {
		@@ -16,6 +16,7 @@ import {
16	16	type TakeError,
17	17	} from "../core/following.ts";
18	18	import { canRead, getRepoById, type Repo } from "../core/repos.ts";
	19	import { commitIdentity } from "../core/commit_identity.ts";
19	20	import type { User } from "../core/users.ts";
20	21	import { divergence } from "../git/branches.ts";
21	22	import { resolveOid } from "../git/merge.ts";
		@@ -81,8 +82,7 @@ export async function takeUpdates(
81	82	const who = writer.value;
82	83	return take(app, fork, parent, {
83	84	id: who.id,
84		name: who.displayName \|\| who.username,
85		email: who.email,
	85	...commitIdentity(app.config, who),
86	86	});
87	87	}
88	88
		@@ -51,6 +51,7 @@ import {
51	51	type Side,
52	52	type ThreadState,
53	53	} from "../core/reviews.ts";
	54	import { commitIdentity } from "../core/commit_identity.ts";
54	55	import { getUserById, getUserByName, type User } from "../core/users.ts";
55	56	import type { MergeStrategy } from "../git/merge.ts";
56	57	import { fetchInto, resolveOid, writeRef } from "../git/merge.ts";
		@@ -339,31 +340,20 @@ export async function mergePull(
339	340	// A fork may have pushed since the pull opened; merge what is being
340	341	// proposed now, not the snapshot taken when it was.
341	342	await refreshPullHead(app, repo, pull);
342		const lander = {
343		name: writer.value.displayName \|\| writer.value.username,
344		email: writer.value.email,
345		};
	343	const lander = commitIdentity(app.config, writer.value);
346	344	// The agent that wrote the change is the commit's author; the person who
347	345	// asked is named in `Requested-by`, the person who landed it in
348	346	// `Co-authored-by`.
349	347	const writtenBy = getUserById(app.db, pull.authorId);
350	348	const agentAuthor =
351	349	writtenBy?.kind === "agent"
352		? {
353		name: writtenBy.displayName \|\| writtenBy.username,
354		email: writtenBy.email,
355		}
	350	? commitIdentity(app.config, writtenBy)
356	351	: undefined;
357	352	const asked = toldBy(app.db, pull);
358	353	const requester =
359	354	asked === null ? undefined : getUserByName(app.db, asked);
360	355	const trailers = landingTrailers(
361		requester
362		? {
363		name: requester.displayName \|\| requester.username,
364		email: requester.email,
365		}
366		: null,
	356	requester ? commitIdentity(app.config, requester) : null,
367	357	lander,
368	358	);
369	359	const merged = await landPull(
		@@ -22,6 +22,7 @@ import {
22	22	type Repo,
23	23	type RepoSettings,
24	24	} from "../core/repos.ts";
	25	import { commitIdentity } from "../core/commit_identity.ts";
25	26	import type { User } from "../core/users.ts";
26	27	import {
27	28	createWebhook as insertWebhook,
		@@ -334,10 +335,7 @@ export async function commitToBranch(
334	335	...(branch !== startPoint ? { startPoint } : {}),
335	336	message: input.message \|\| "Update files",
336	337	files: input.files,
337		author: {
338		name: writer.value.displayName \|\| writer.value.username,
339		email: writer.value.email,
340		},
	338	author: commitIdentity(app.config, writer.value),
341	339	},
342	340	);
343	341	if (!committed.ok) return committed;
		@@ -10,6 +10,7 @@
10	10	import type { App } from "../app.ts";
11	11	import { revertOf, type Pull } from "../core/pulls.ts";
12	12	import type { Repo } from "../core/repos.ts";
	13	import { commitIdentity } from "../core/commit_identity.ts";
13	14	import type { User } from "../core/users.ts";
14	15	import { resolveOid } from "../git/merge.ts";
15	16	import { repoDir } from "../git/repos.ts";
		@@ -58,10 +59,7 @@ export async function revertPull(
58	59	commitOid: pull.mergedOid,
59	60	ontoOid: onto,
60	61	message: `Revert "${pull.title}" (#${pull.number})`,
61		author: {
62		name: writer.value.displayName \|\| writer.value.username,
63		email: writer.value.email,
64		},
	62	author: commitIdentity(app.config, writer.value),
65	63	});
66	64	if (!built.ok) return built;
67	65
		@@ -94,7 +94,7 @@ export function updateProfile(
94	94	if (!user.ok) return user;
95	95	const updated = writeProfile(app.db, user.value.id, patch);
96	96	if (!updated.ok) return updated;
97		const fields = (["displayName", "email"] as const).filter(
	97	const fields = (["displayName", "email", "commitEmail"] as const).filter(
98	98	(k) => patch[k] !== undefined,
99	99	);
100	100	app.bus.append({
		@@ -0,0 +1,44 @@
	1	/**
	2	* The name and address a commit the forge writes for a person carries.
	3	*
	4	* A commit is published in every clone of a public repository, forever, and
	5	* an address in it cannot be taken back without rewriting history. So the
	6	* address is one the person chose to publish: a no-reply address on this
	7	* forge's own host unless they opted in to their account email on the
	8	* settings page (#623). The account email itself is never the default.
	9	*/
	10
	11	import type { ForgeConfig } from "../app.ts";
	12	import type { User } from "./users.ts";
	13
	14	export interface CommitIdentity {
	15	readonly name: string;
	16	readonly email: string;
	17	}
	18
	19	/** The host this forge is reached at: its public URL's, else its own name. */
	20	export function forgeHost(config: Pick<ForgeConfig, "url" \| "host">): string {
	21	return config.url !== undefined
	22	? new URL(config.url).hostname
	23	: (config.host ?? "localhost");
	24	}
	25
	26	/** `<username>@users.noreply.<host>` — an address that reaches nobody. */
	27	export function noreplyAddress(username: string, host: string): string {
	28	return `${username}@users.noreply.${host}`;
	29	}
	30
	31	/**
	32	* Who a commit says wrote it. An agent's address is the forge's own
	33	* invention (`…@agents.invalid`) and names nobody's mailbox, so it is used
	34	* as it is; a person's is their no-reply address unless they opted in.
	35	*/
	36	export function commitIdentity(
	37	config: Pick<ForgeConfig, "url" \| "host">,
	38	user: Pick<User, "username" \| "displayName" \| "email" \| "kind" \| "commitEmail">,
	39	): CommitIdentity {
	40	const name = user.displayName \|\| user.username;
	41	if (user.kind === "agent" \|\| user.commitEmail === "account")
	42	return { name, email: user.email };
	43	return { name, email: noreplyAddress(user.username, forgeHost(config)) };
	44	}
		@@ -1189,4 +1189,10 @@ export const migrations: readonly string[] = [
1189	1189	created_at TEXT NOT NULL
1190	1190	);
1191	1191	`,
	1192	// 46 — which address the forge's commits for a person carry (#623). The
	1193	// default is the no-reply one; the account email is an explicit opt-in.
	1194	`
	1195	ALTER TABLE user ADD COLUMN commit_email TEXT NOT NULL DEFAULT 'noreply'
	1196	CHECK (commit_email IN ('noreply','account'));
	1197	`,
1192	1198	];